%q not hit", reason) } } } func BenchmarkCAST(b *testing.B) { // IG 10.3.A says "ML-DSA digital signature generation CASTs should cover // all applicable rejection sampling loop paths". For ML-DSA-44, there are // four paths. For ML-DSA-65 and ML-DSA-87, only three. This benchmark helps // us figure out which is faster: four rejections of ML-DSA-44, or three of // ML-DSA-65. (It's the former, but only barely.) b.Run("ML-DSA-44", func(b *testing.B) { // Same as TestACVPRejectionKAT/Test/Path/ML-DSA-44/1....

portions are going to be only 32 bits, plus any previous excess, // so we can skip the carry propagation. return v } // mul51 returns lo + hi * 2⁵¹ = a * b. func mul51(a uint64, b uint32) (lo uint64, hi uint64) { mh, ml := bits.Mul64(a, uint64(b)) lo = ml & maskLow51Bits hi = (mh << 13) | (ml >> 51) return } // Pow22523 set v = x^((p-5)/8), and returns v. (p-5)/8 is 2^252-3. func (v *Element) Pow22523(x *Element) *Element { var t0, t1, t2 Element t0.Square(x) // x^2 t1.Square(&t0) // x^4 t1.Square(&t1)...

    * LiteRT announced a [new release](https://developers.googleblog.com/en/litert-maximum-performance-simplified/) at Google IO ‘25 that improves upon TFLite, particularly in terms of NPU and GPU hardware acceleration and performance for on-device ML and AI applications. The APIs are available in Kotlin and C++.